From e109093b834993f57a2e4a93307f2358fc1be339 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathias=20D=C3=BCsterh=C3=B6ft?= Date: Tue, 4 Oct 2016 05:30:17 +0200 Subject: [PATCH] add config option to not ignore security headers (#1354) * add config option to not ignore security headers * fix field documentation of ignoreSecurityHeaders * add documenation for zuul.ignoreSecurityHeaders fixes gh-1096 --- docs/src/main/asciidoc/spring-cloud-netflix.adoc | 3 +++ .../cloud/netflix/zuul/filters/ZuulProperties.java | 13 +++++++++++-- .../netflix/zuul/filters/ZuulPropertiesTests.java | 9 +++++++++ 3 files changed, 23 insertions(+), 2 deletions(-) diff --git a/docs/src/main/asciidoc/spring-cloud-netflix.adoc b/docs/src/main/asciidoc/spring-cloud-netflix.adoc index 8fe0017e..53961116 100644 --- a/docs/src/main/asciidoc/spring-cloud-netflix.adoc +++ b/docs/src/main/asciidoc/spring-cloud-netflix.adoc @@ -1413,6 +1413,8 @@ need to set it unless you want it to be different. N.B. this is new in Spring Cloud Netflix 1.1 (in 1.0 the user had no control over headers and all cookies flow in both directions). +=== Ignored Headers + In addition to the per-route sensitive headers, you can set a global value for `zuul.ignoredHeaders` for values that should be discarded (both request and response) during interactions with downstream @@ -1421,6 +1423,7 @@ classpath, and otherwise they are initialized to a set of well-known "security" headers (e.g. involving caching) as specified by Spring Security. The assumption in this case is that the downstream services might add these headers too, and we want the values from the proxy. +To not discard these well known security headers in case Spring Security is on the classpath you can set `zuul.ignoreSecurityHeaders` to `false`. This can be useful if you disabled the HTTP Security response headers in Spring Security and want the values provided by downstream services === The Routes Endpoint diff --git a/spring-cloud-netflix-core/src/main/java/org/springframework/cloud/netflix/zuul/filters/ZuulProperties.java b/spring-cloud-netflix-core/src/main/java/org/springframework/cloud/netflix/zuul/filters/ZuulProperties.java index 9d3278df..b621f59d 100644 --- a/spring-cloud-netflix-core/src/main/java/org/springframework/cloud/netflix/zuul/filters/ZuulProperties.java +++ b/spring-cloud-netflix-core/src/main/java/org/springframework/cloud/netflix/zuul/filters/ZuulProperties.java @@ -42,6 +42,7 @@ import static com.netflix.hystrix.HystrixCommandProperties.ExecutionIsolationStr /** * @author Spencer Gibb * @author Dave Syer + * @author Mathias Düsterhöft */ @Data @ConfigurationProperties("zuul") @@ -50,7 +51,7 @@ public class ZuulProperties { /** * Headers that are generally expected to be added by Spring Security, and hence often * duplicated if the proxy and the backend are secured with Spring. By default they - * are added to the ignored headers if Spring Security is present. + * are added to the ignored headers if Spring Security is present and ignoreSecurityHeaders = true. */ public static final List SECURITY_HEADERS = Arrays.asList("Pragma", "Cache-Control", "X-Frame-Options", "X-Content-Type-Options", @@ -101,6 +102,14 @@ public class ZuulProperties { */ private Set ignoredHeaders = new LinkedHashSet<>(); + /** + * SECURITY_HEADERS are added to ignored headers if spring security is on the classpath and ignoreSecurityHeaders = true + * By setting ignoreSecurityHeaders to false we can switch off this default behaviour. This should be used together with + * disabling the default spring security headers + * see https://docs.spring.io/spring-security/site/docs/current/reference/html/headers.html#default-security-headers + */ + private boolean ignoreSecurityHeaders = true; + /** * Path to install Zuul as a servlet (not part of Spring MVC). The servlet is more * memory efficient for requests with large bodies, e.g. file uploads. @@ -148,7 +157,7 @@ public class ZuulProperties { Set ignoredHeaders = new LinkedHashSet<>(this.ignoredHeaders); if (ClassUtils.isPresent( "org.springframework.security.config.annotation.web.WebSecurityConfigurer", - null) && Collections.disjoint(ignoredHeaders, SECURITY_HEADERS)) { + null) && Collections.disjoint(ignoredHeaders, SECURITY_HEADERS) && ignoreSecurityHeaders) { // Allow Spring Security in the gateway to control these headers ignoredHeaders.addAll(SECURITY_HEADERS); } diff --git a/spring-cloud-netflix-core/src/test/java/org/springframework/cloud/netflix/zuul/filters/ZuulPropertiesTests.java b/spring-cloud-netflix-core/src/test/java/org/springframework/cloud/netflix/zuul/filters/ZuulPropertiesTests.java index 60e25406..9ea87b50 100644 --- a/spring-cloud-netflix-core/src/test/java/org/springframework/cloud/netflix/zuul/filters/ZuulPropertiesTests.java +++ b/spring-cloud-netflix-core/src/test/java/org/springframework/cloud/netflix/zuul/filters/ZuulPropertiesTests.java @@ -29,6 +29,7 @@ import static org.junit.Assert.assertTrue; /** * @author Dave Syer + * @author Mathias Düsterhöft */ public class ZuulPropertiesTests { @@ -46,10 +47,18 @@ public class ZuulPropertiesTests { @Test public void defaultIgnoredHeaders() { + assertTrue(this.zuul.isIgnoreSecurityHeaders()); assertTrue(this.zuul.getIgnoredHeaders() .containsAll(ZuulProperties.SECURITY_HEADERS)); } + @Test + public void securityHeadersNotIgnored() { + zuul.setIgnoreSecurityHeaders(false); + + assertTrue(this.zuul.getIgnoredHeaders().isEmpty()); + } + @Test public void addIgnoredHeaders() { this.zuul.setIgnoredHeaders(Collections.singleton("x-foo"));